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BRIEF ON APPEAL 

Mail Stop Appeal Brief-Patents 
Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 

Sir: 

This Brief is being submitted in support of a Notice of Appeal filed on September 

1, 2009, in connection with a Pre- Appeal Brief Request for Review submitted in response 
to a final Office action dated April 1, 2009, in which claims 1-7 and 9-24 were finally 
rejected. In response to the Notice of Appeal and Pre- Appeal Brief Request for Review, 
a Notice of Panel Decision from Pre- Appeal Brief Review indicating that there is at least 

one actual issue for appeal was mailed on May 12, 2010. The assignee respectfully 
submits the instant Brief on Appeal in response to the Notice of Panel Decision from Pre- 
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Appeal Brief Review and in accordance with 37 C.F.R. § 41.37, along with a petition for 
an appropriate extension of time. 

I. Real Party In Interest 

The above-referenced patent application has been assigned to SBC Knowledge 
Ventures, L.P., which is now known as AT&T Intellectual Property I, L.P. AT&T 
Intellectual Property I, L.P. is the real party in interest to this appeal. The assignment 
from the inventors to SBC Knowledge Ventures, L.P. has been recorded in the United 
States Patent and Trademark Office ("PTO") at Frame 0277 of Reel 015025. 

II. Related Appeals and Interferences 
There are no related appeals or interferences. 

III. Status of the Claims 

Currently, claims 1-7 and 9-24 are pending in this application. Claim 8 has been 
previously cancelled. The status of all claims is presented in the Claims Appendix of this 
Brief. Claims 1-7 and 9-24 stand rejected and form the subject matter of this appeal. 

IV. Status of the Amendments 

All amendments that were made in this application have been entered. No 
amendments were filed after the final Office action. 

V. Summary of the Claimed Sub ject Matter 

Although reference numerals and specification citations are inserted below in 

accordance with 37 C.F.R. 41.37(c)(l)(v), these references numerals and citations are 

merely examples of where support may be found in the specification for the terms used in 
2 
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this section of the brief. There is no intention to in any way suggest that the terms of the 
claims are limited to the examples in the specification. Although, as demonstrated by the 
reference numerals and citations below, the claims are fully supported by the 
specification as required by law, it is improper under the law to read limitations from the 
specification into the claims. Pointing out specification support for the claim 
terminology as is done here to comply with Rule 41.37(c)(l)(v) does not in any way limit 
the scope of the claims to those examples from which they find support. Nor does this 
exercise provide a mechanism for circumventing the law precluding reading limitations 
into the claims from the specification. In short, the reference numerals and specification 
citations are not to be construed as claim limitations or in any way used to limit the scope 
of the claims. 

The invention as defined in independent claim 1 is directed toward a method for 

analyzing data content received at a local area network from an external communications 

network. {Specification, \ [0005], and \ [0028] as amended on January 22, 2007; FIG. 

6.) The method includes receiving unanalyzed content at a local area network {Id.), and 

passing the unanalyzed content to a switch in the local area network {Id.). The method 

also includes analyzing the unanalyzed content at the switch and generating analyzed 

data. {Id.) The method further includes routing the analyzed data to a device in the local 

area network in communication with the switch {Specification, \ [0005], and \ [0028] as 

amended on January 22, 2007), wherein the switch comprises a plurality of ports {Id. at 

IK [0015], [0016]; FIG. 3), and wherein analyzing the unanalyzed content at the switch 
3 
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comprises the switch scanning the plurality of pori;s and applying a content analysis 
algorithm to each of the plurality of ports {Specification at II [0005], [0019], and^ 
[0028] as amended on January 22, 2007), wherein applying the content analysis 
algorithm comprises applying a first content analysis algorithm to a first port of the 
plurality of ports and applying a second content analysis algorithm to a second port of the 
plurality of ports {Id. at ffl [0017], [0019], and \ [0028] as amended on January 22, 
2007), wherein the second content analysis algorithm is different than the first content 
analysis algorithm {Id. atffl [0017], [0019]). 

The invention of claim 2 further defines analyzing the unanalyzed content as 
recited in claim 1 to include applying a content filtering algorithm to the unanalyzed 
content upon ingress at one of the plurality of ports. {Id. at % [0029].) 

The invention of claim 3 further defines analyzing the unanalyzed content as 
recited in claim 1 to include applying a content filtering algorithm to the unanalyzed 
content upon egress at one of the plurality of ports. {Id. at \ [0029].) 

The invention of claim 4 further defines that the unanalyzed content as recited in 
claim 1 is formatted in data packets. {Id. at \ [0029].) 

The invention of claim 5 further defines analyzing the unanalyzed content at the 
switch as recited in claim 1 and in view of claim 4 to include the switch applying the 
content analysis algorithm to each data packet of unanalyzed content. {Id. at \ [0029], 
and \ [0028] as amended on January 22, 2007.) 
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The invention of claim 6 further defines the switch applying the content analysis 
algorithm as recited in claim 5 to include the switch executing an antivirus algorithm. 
{Id. atii [0005], [0016], [0017], [0019].) 

The invention of claim 7 further defines the switch applying the content analysis 
algorithm as recited in claim 5 to include the switch executing an intrusion detection 
algorithm. {Id. atffl [0005], [0016].) 

The invention of claim 9 further defines that each of the plurality of ports as 
recited in claim 1 includes a dedicated processor {Id. at^*][ [0007], [0016]), and that each 
dedicated processor for a respective port independently applies a separate content 
analysis algorithm to unanalyzed content at the port {Id. at ^ [0017], [0019]), whereby 
each of the plurality of ports analyzes content with its respective processor {Id.). 

The invention of claim 10 further defines the method as recited in claim 1 to 
include receiving a content analysis software update at the switch from a managed 
service provider network via the extemal communications network. {Id. at ^ [0006], 
[0008], [0021], and I [0020] as amended on January 22, 2007.) 

The invention of claim 1 1 further defines the method as recited in claim 10 to 
include applying the content analysis software update to each of the plurality of ports at 
the switch configured to implement content analysis software contained in the content 
analysis software update. (Id. atffl [0008], [0017], [0019], [0021], and S[ [0027] as 
amended on January 22, 2007.) 
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The invention as defined in independent claim 12 is directed toward a method of 
managing content analysis for a local area network from a managed service provider 
network (Id. at f [0006], and f [0028] as amended on January 22, 2007; FIG. 5), wherein 
the local area network comprises a switch in communication with an extemal 
conmiunications network and at least one device in conmiunication with the switch 
{Specification atff [0006], [0015]; FIG. 2). The method includes establishing a 
communication link between the switch of the local area network and the managed 
service provider network via the extemal communications network. (Specification at fl 
[0006], [0021].) The method also includes transmitting port configuration instructions 
from the managed service provider network to the switch of the local area network. (Id. 
at f [0006], and 11 [0026], [0027] as amended on January 22, 2007.) In the recited 
method, the port configuration instructions include instructions to configure a plurality of 
ports on a port-to-port basis at the switch to implement at least two content analysis 
functions (Id. atff [0006], [0017], [0019], andl [0026] as amended on January 22, 2007) 
and to cause the switch to scan and apply a first content analysis function to a first 
selected port of the plurality of ports and scan and apply a second content analysis 
function to a second selected port of the plurality of ports (Id. at ff [0017], [0019], and f 
[0028] as amended on January 22, 2007), wherein the second content analysis function is 
different than the first content analysis function (Id. at H [0017], [0019]). 

The invention of claim 13 further defines the method as recited in claim 12 to 

include receiving a content analysis software update at the managed service provider 
6 
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network {Id. at \ [0006], and \ [0027] as amended on January 22, 2007), transmitting the 
content analysis software update to the switch {Id. atff [0006], [0008], andl [0027] as 
amended on January 22, 2007), and updating content analysis software at the switch with 
the content analysis software update {Id. atffl [0008], [0019], [0021], and^ [0027] as 
amended on January 22, 2007). 

The invention of claim 14 further defines the method as recited in claim 12 to 
include monitoring content analysis activity at the switch from the managed service 
provider network. {Id. atffl [0006], [0022].) 

The invention as defined in independent claim 15 is directed toward a method of 

providing content analysis policy to a plurality of networks. {Id. at \ [0008].) The 

method includes establishing a communication link between a switch in each of a 

plurality of subscriber networks and an application management appliance of a managed 

service provider network via an external communications network. {Id. at ^ [0008], 

[0021]; FIG. 4.) The method also includes transmitting one of instructions or update 

information for a content analysis application from the application management appliance 

to the switch in each of the plurality of subscriber networks {Specification at H [0008], 

[0021], and^ [0020] as amended on January 22, 2007), the content analysis application 

comprising a first content analysis application and a second content analysis application 

{Id. at IK [0017], [0019]), wherein the switch in each of the plurality of subscriber 

networks comprises a plurality of ports {Id. at W [0015], [0016]; FIG. 3). The method 

further includes applying the first content analysis application to a first port of the 
7 
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plurality of ports and applying the second content analysis application to a second port of 

the plurality of ports (Specification at ff [0017], [0019], and f [0028] as amended on 

January 22, 2007), wherein the second content analysis application is different than the 

first content analysis application (Id. atff [0017], [0019]). Additionally, the method 

includes receiving performance metrics of the first and second different content analysis 

applications from each of the plurality of subscriber networks (Id. at fl [0008], [0022], 

and It [0030] as amended on January 22, 2007), and wherein receiving performance 

metrics comprises receiving performance metrics for each of the plurality of ports in 

substantially real time (Id. at f [0030] as amended on January 22, 2007). 

The invention as defined in independent claim 16 is directed toward a local area 

network switch system having content analysis capabilities. (Id. at 1 [0007].) The 

system includes a billing server (Id. at % [0021], and % [0026] as amended on January 22, 

2007), and a plurality of ports in conmiunication with the billing server (Id.), each of the 

plurality of ports configured for communication with a respective external device (Id. at 

[0007], [0015]). In the recited system, each of the ports includes: an interface 

connection adapted for connecting with a communication line of an external device (Id. at 

ffl [0007], [0016]); a processor in conmiunication with the interface connection (Id.); a 

memory in communication with the processor (Id.); an application buffer in 

communication with the processor and the memory (Id.), wherein the application buffer 

contains logic operative on the processor to analyze a content of information passing 

between the external device and the port (Id.); and a conmiunication bus in 
8 
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communication with each of the plurality of ports {Id.), the communication bus adapted 
to carry information between the plurality of ports (Id.). Additionally, a first application 
buffer contains logic for applying a first content analysis algorithm to a first port of the 
plurality of ports and a second application buffer contains logic for applying a second 
content analysis algorithm to a second port of the plurality of ports {Id. at ^ [0017], 
[0019]), wherein the second content analysis algorithm is different than the first content 
analysis algorithm {Id.). Furthermore, the billing server is operable to track charges for 
content analysis services and bill on a per port basis. {Id. at \ [0026] as amended on 
January 22, 2007.) 

The invention of claim 17 further defines the system as recited in claim 16 to 
include an application buffer administrative interface in communication with the 
communication bus {Id. at^ [0017]), wherein the application buffer administrative 
interface comprises content analysis resources accessible by the application buffer for 
each of the plurality of ports {Id.). 

The invention of claim 18 further defines that at least one of the application 
buffers as recited in claim 16 is to include anti- virus filtering logic. {Id. at \ [0017].) 

The invention of claim 19 further defines that at least one of the application 
buffers as recited in claim 16 is to include network security logic. {Id. at \ [0017].) 

The invention of claim 20 further defines that at least one of the application 
buffers as recited in claim 16 is to include content filtering logic. {Id. at \ [0017].) 
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The invention of claim 21 further defines the application buffer administrative 

interface as defined in claim 17 is to include anti-virus definitions adapted for use by 
anti-virus logic stored on an application buffer at each of the plurality of ports. {Id. at \ 
[0017].) 

The invention as defined in independent claim 22 is directed toward a method for 

analyzing data content received at a local area network from an external communications 

network. {Id. at \ [0005], and \ [0028] as amended on January 22, 2007.) The method 

includes receiving at a local area network unanalyzed data content in a data field of a data 

packet formatted according to a communications protocol {Id. at ^ [0005], [0029], and \ 

[0028] as amended on January 22, 2007), and passing the unanalyzed content to a switch 

in the local area network {Id. at % [0005], and % [0028] as amended on January 22, 2007). 

The method also includes analyzing the unanalyzed content at the switch and generating 

analyzed data. {Id.) The method further includes routing the analyzed data to a device in 

the local area network in communication with the switch {Id.), wherein the switch 

comprises a plurality of ports {Id. at ff [0015], [0016]), and wherein analyzing the 

unanalyzed content at the switch comprises the switch scanning the plurality of ports and 

applying a content analysis algorithm to each of the plurality of ports {Id. at ^ [0005], 

[0019], and^ [0028] as amended on January 22, 2007), wherein applying the content 

analysis algorithm comprises applying a first content analysis algorithm to a first port of 

the plurality of ports and applying a second content analysis algorithm to a second port of 

the plurality of ports {Id. at H [0017], [0019], andll [0028] as amended on January 22, 
10 
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2007), wherein the second content analysis algorithm is different than the first content 
analysis algorithm (Id. atffl [0017], [0019]). 

The invention of claim 23 further defines the first content analysis algorithm as 
recited in claim 22 to include a first data content analysis algorithm (Id. at [0005], 
[0019]), and the second content analysis algorithm as recited in claim 22 to include a 
second data content analysis algorithm (Id.). 

The invention as defined in independent claim 24 is directed toward a method for 

analyzing data content received at a local area network from an external communications 

networlc. (Id. at f [0005], and f [0028] as amended on January 22, 2007.) The method 

includes receiving at a local area network unanalyzed data content in a data field of a data 

packet formatted according to a communications protocol (Id. at 11 [0005], [0029], and 1 

[0028] as amended on January 22, 2007), and passing the unanalyzed content to a switch 

in the local area network (Id. at f [0005], and f [0028] as amended on January 22, 2007). 

The method also includes analyzing the unanalyzed content at the switch and generating 

analyzed data. (Id.) The method further includes routing the analyzed data to a device in 

the local area network in communication with the switch (Id.), wherein the switch 

comprises a plurality of ports (Id. at fl [0015], [0016]), and wherein analyzing the 

unanalyzed content at the switch comprises the switch scanning the plurality of ports and 

applying a data content analysis algorithm to each of the plurality of ports (Id. at H 

[0005], [0019], andl [0028] as amended on January 22, 2007), wherein applying the data 

content analysis algorithm comprises applying a first data content analysis algorithm to a 
11 
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first port of the plurality of ports and applying a second data content analysis algorithm to 
a second port of the plurality of ports {Id. at [0017], [0019], and \ [0028] as amended 
on January 22, 2007), wherein the second data content analysis algorithm is different than 
the fkst data content analysis algorithm {Id. at [0017], [0019]). 

VI. Grounds of Re jection To Be Reviewed on Appeal 

The grounds of rejection to be reviewed on appeal are as follows: 

Ground 1: The rejections of claims 1-7, 10-14 and 22-24 as unpatentable over 
the combination of Islam (U.S. Publication No. 2003/0035430), 
Vairavan (U.S. Publication No. 2002/0083344) and Jain (U.S. 
Patent No. 6,324,575) under 35 U.S.C. § 103. 

Ground 2: The rejection of claim 9 as unpatentable over the combination of 
Islam, Vairavan, Jain and Wilson (U.S. Patent No. 4,292,465) 
under 35 U.S.C. § 103. 

Ground 3: The rejection of claim 15 as unpatentable over the combination of 
Islam, Webb (U.S. Publication No. 2002/0120741) and Jain under 
35 U.S.C. § 103. 

Ground 4: The rejections of claims 16-21 as unpatentable over the 

combination of Webb, Vairavan, Van Home (U.S. Patent No. 
5,987,430) and Jain under 35 U.S.C. § 103. 

VII. Argument 

Ground 1. Claims 1-7, 10-14 and 22-24 are 

Patentable Over the Combination of Islam, Vairavan and Jain 

Claims 1-7. 10-14 and 22-24 

A. The Combination of Islam, Vairavan and Jain is Missing at Least One 
Element of Claim 1 



Claim 1 is repeated here for ease of reference: 



12 



U.S. Serial No. 10/682,366 
Brief on Appeal 

1 . A method for analyzing data content received at a 
local area network from an external communications 
network, wherein the method comprises: 

receiving unanalyzed content at a local area 
network; 

passing the unanalyzed content to a switch in the 
local area network; 

analyzing the unanalyzed content at the switch and 
generating analyzed data; and 

routing the analyzed data to a device in the local 
area network in communication with the switch, wherein 
the switch comprises a plurality of ports, and wherein 
analyzing the unanalyzed content at the switch comprises 
the switch scanning the plurality of ports and applying a 
content analysis algorithm to each of the plurality of ports, 

wherein applying the content analysis algorithm 
compiises applying a first content analysis algorithm to a 
first port of the plurality of ports and applying a second 
content analysis algorithm to a second port of the 
plurality of ports, wherein the second content analysis 
algorithm is different than the first content analysis 
algorithm. 

It is well-settled that a prima facie case of obviousness under a rationale of 
combining prior art elements requires "a finding that the prior art included each element 
claimed, although not necessarily in a single prior art reference, with the only difference 
between the claimed invention and the prior art being the lack of actual combination of 
the elements in a single prior art reference." M.P.E.P. § 2143(A) (citing KSR 

International Co. v. Teleflexlnc, 550 U.S. 398, , 82 USPQ2d 1385, 1395-97 (2007)). 

Here, claim 1 is nonobvious and, thus, patentable because the combination of Islam, 
Vairavan and Jain fails to teach or suggest applying a first content analysis algorithm to a 
first port of a plurality of ports and applying a second content analysis algorithm to a 
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second port of a plurality of ports, wherein the second content analysis algorithm is 

different than the first content analysis algorithm. 

B. The Combination of Islam and Vairavan Fails to Teach or Suggest Applying 
the First and Second Content Analysis Algorithms as Recited in Claim 1 

As noted above, the final Office action rejected claims 1-7, 10-14 and 22-24 as 

being unpatentable over the combination of Islam, Vairavan and Jain under 35 U.S.C. § 

103. However, in the final Office action, the Examiner acknowledged that the 

combination of Islam and Vairavan fails to describe applying a first content analysis 

algorithm to a first port of a plurality of ports and applying a second content analysis 

algorithm to a second port of a plurality of ports, wherein the second content analysis 

algorithm is different than the first content analysis algorithm, as recited in claim 1. 

{Final Office Action, page 4, lines 3-7.) The assignee respectfully agrees with this 

determination. 

C. Jain Fails to Qyercome the Deficiencies of the Islam and Vairavan 
Combination with Respect to Claim 1 

The Examiner relies on Jain to overcome the acknowledged deficiencies of the 

Islam and Vairavan combination with respect to claim 1. However, the assignee 

respectfully submits that the Examiner's reliance on Jain is misplaced because, contrary 

to the Examiner's assertion (see the Final Office Action, page 17, lines 2-7), determining 

whether to select between two multicast filtering options at each port of a switch, as 

described in Jain, is not the same as applying two different content analysis algorithms at 

two different ports, as recited in claim 1. Instead Jain, like Islam and Vairavan, also fails 

14 



U.S. Serial No. 10/682,366 
Brief on Appeal 

to teach or suggest applying a first content analysis algorithm to a first port of a plurality 
of ports and applying a second content analysis algorithm to a second port of a plurality 
of ports, wherein the second content analysis algorithm is different than the first content 
analysis algorithm, as recited in claim 1. 

Jain describes a switch having multiple ports. {Jain, col. 6, lines 38-41.) At each 
port, Jain 's switch determines whether one or more clients coupled to the port support 
group multicast regsitration protocol (GMRP) and, thus, are compliant with the Institute 
of Electrical and Electronics Engineers (IEEE) 802. Ip protocol incorporated into the 
IEEE 802. ID standard. (Id. at col. 7, lines 19-23; col. 8, lines 20-29.) If all clients 
coupled to the port support GMRP, then Jain 's switch automatically selects a first 
multicast filtering mode corresponding to a Filter Unregistered Groups mode for the port. 
(Id. at col. 8, lines 30-43.) However, if at least one client coupled to the port does not 
support GMRP, then Jain's switch automatically selects a second multicast filtering 
mode corresponding to a Forward All Groups mode for the port. (Id. at col. 8, lines 44- 
61.) 

In other words, Jain's switch implements one of two options at each of its ports. 
In particular, each port applies either one type of multicast filtering (i.e., filtering 
unregistered groups when Filter Unregistered Groups is selected) or no multicast filtering 
(i.e., forwarding all groups when Forward All Groups is selected). Thus, Jain describes 
only one type of multicast filtering algorithm (i.e.. Filter Unregistered Groups) and each 
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port can either apply this same multicast filtering algorithm to incoming packets, or apply 
no multicast filter processing to the incoming packets. 

In contrast to Jain, the method of claim 1 recites two different content analysis 
algorithms being applied at two different ports of a switch. The broadest reasonable 
interpretation of the term "content analysis algorithm," which is consistent with the use of 
this term in the specification (see e.g. the Specification, ffl [0016], [0019], [0020], 
[0028]), requires that the algorithm performs some type of analysis on the content 
received at the port. Thus, the method of claim 1 requires two different content analysis 
algorithms, where each algorithm performs some different type of analysis of the content 
received at its respective port. However, even assuming for the sake of argument that 
Jain 's multicast filtering is a content analysis algorithm in the context of claim 1 (a point 
not conceded by the assignee), Jain at most describes only one type of algorithm, namely 
filtering unregistered groups when Filter Unregistered Groups is selected, that can be 
applied to any given switch port. Jain's other option. Forward All Groups, actually 
performs no filtering (because all groups are forwarded) and, thus, corresponds to 
applying no analysis of the content at the given switch port. Clearly, the absence of 
applying any analysis of the content at a port cannot teach or suggest applying a second 
content analysis algorithm, because no content analysis is performed. 

Thus, even when viewed in a most favorable light, Jain could at most suggest 

applying either the same content analysis algorithm (i.e.. Filter Unregistered Groups) at 

two different ports, or applying this content analysis algorithm at one port and no content 
16 
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analysis algorithm at the other port. However, Jain does not teach or suggest applying 
two different content analysis algorithms at two different ports, as recited in claim 1. 
Simply put, the Examiner's contention that Jain's second option (i.e.. Forward All 
Groups) teaches a different, second content analysis algorithm, as recited in claim 1, is 
unreasonable and, thus, in error because Jain's second option performs no content 
analysis. 

Accordingly, Jain fails to teach or suggest applying a first content analysis 
algorithm to a first port of a plurality of ports and applying a second content analysis 
algorithm to a second port of the plurality of ports, wherein the second content analysis 
algorithm is different than the first content analysis algorithm, as recited in claim 1. 

Because Islam, Vaimvan and Jain all fail to teach or suggest the same element of claim 1, 
the assignee respectfully submits that the obviousness rejection of claim 1 under 35 
U.S.C. § 103 was in error and should be reversed by the Board. 
D. Claims 2-5. 7 and 10-11 

"If an independent claim is nonobvious under 35 U.S.C. 103, then any claim 
depending therefrom is nonobvious." M.P.E.P. § 2143.03 (citing In re Fine, 837 F.2d 
1071, 5 USPQ2d 1596 (Fed. Ck. 1988)). Claims 2-7 and 10-11 depend on claim 1. As 
such, the foregoing argument demonstrating the patentability of claim 1 likewise 
demonstrates the patentability of these dependent claims. Accordingly, the rejections of 
claims 2-7 and 10-11, which depend on claim 1, should be reversed by the Board. 
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E. Claim 6 

Claim 6 depends on claim 1. Therefore, for at least the reasons the rejection of 
claim 1 must be reversed, the rejection of claim 6 must likewise be reversed. 

Furthermore, claim 6 specifies that the switch applying the content analysis 
algorithm as recited in claim 5 is to include the switch executing an antivirus algorithm. 
Claim 5 specifies that analyzing the unanalyzed content at the switch as recited in claim 1 
and in view of claim 4 is to include the switch applying the content analysis algorithm to 
each data packet of unanalyzed content. Claim 1 specifies that analyzing the unanalyzed 
content at the switch comprises the switch scanning the plurality of ports and applying a 
content analysis algorithm to each of the plurality of ports. The content analysis 
algorithm recited in claim 6 is the same of the content analysis algorithm recited in 
claims 1 and 5. As recited in claim 1, the content analysis algorithm is applied to a 
switch port. Thus, properly construed, claim 6 requires the switch to execute an antivirus 
algorithm for application at a port of the switch. 

The Examiner contends that the recitation of claim 6 may be found at paragraph 
[0105] of Vairavan. Paragraph [0105] of Vairavani is repeated here for ease of 
reference: 

[0105] An anti-virus module 330 is also included within the 
packet processor 210. The anti-virus module 330 is coupled 
to the first internal packet bus 335, the second internal 
packet bus 345, and the internal control bus 340. The anti- 
virus module 330 provides an anti-virus agent that monitors 
devices on an attached network for viruses. Additionally, 
the anti-virus module 330 provides automatic updating of 
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an anti-vims package. As a result, virus security is 
controlled by the inter/intra-networking device and any 
updates are centrally pushed onto various devices in the 
enterprise. 

(Vairavan, f [0105]) (emphasis added). As the highlighted portion of paragraph [0105] 
indicates, although the anti-virus module in Vairavani's inter/intra-networking device 
centrally controls an anti- virus package, the anti- virus package is actually pushed to the 
various devices coupled to the inter/intra-networking device. Thus, like the prior art 
described in paragraph [0003] of the instant specification, Vairavani describes 
performing anti-vims detection at each device in the network, instead of applying an anti- 
virus algorithm at a port of the switch, as recited in claim 6. Accordingly, the rejection of 
claim 6 is in error and should be reversed by the Board. 
F. Independent Claim 12 

Independent claim 12 recites, among other things, instmctions "to configure a 
plurality of ports on a port-to-port basis at the switch to implement at least two content 
analysis functions and to cause the switch to scan and apply a first content analysis 
function to a first selected port of the plurality of ports and scan and apply a second 
content analysis - function to a second selected port of the plurality of ports, wherein 
the second content analysis function is different than the first content analysis 
function'' (emphasis added). In the final Office action, the Examiner acknowledged that 
the combination of Islam and Vairavan fails to describe causing a switch to scan and 
apply a second content analysis function to a second selected port of the plurality of 
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ports, wherein the second content analysis function is different than the first content 
analysis function. (Final Office Action, page 6, lines 3-5.) As explained above in 
connection with claim 1, Jain fails to teach or suggest applying two different content 
analysis algorithms at two different ports and, thus, also fails to teach or suggest causing 
a switch to scan and apply a second content analysis function to a second selected port of 
the plurality of ports, wherein the second content analysis function is different than the 
first content analysis function, as recited in claim 12. Because Islam, Vairavan and Jain 
all fail to teach or suggest the same element of claim 12, the assignee respectfully submits 
that the obviousness rejection of claim 12 under 35 U.S.C. § 103 was in error and should 
be reversed by the Board. 

Additionally, the assignee respectfully notes that claim 12 contains a 
typographical error in the form of an extraneous dash after the phrase "second content 
analysis" in the claim. The assignee intends to correct this typographical error upon 
reversal of the rejection of claim 12 by the Board. 
G. Claims 13-14 

Claims 13 and 14 depend on claim 12. As such, the foregoing argument 
demonstrating the patentability of claim 12 likewise demonstrates the patentability of 
these dependent claims. Accordingly, the rejections of claims 13 and 14, which depend 
on claim 12, should be reversed by the Board. 
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H. Independent Claim 22 

Independent claim 22 recites, among other things, "applying a first content 
analysis algorithm to a first port of the plurality of ports and applying a second content 
analysis algorithm to a second port of the plurality of ports, wherein the second content 
analysis algorithm is different than the first content analysis algorithm" (emphasis 
added). In the final Office action, the Examiner acknowledged that the combination of 
Islam and Vairavan fails to describe the foregoing aspect of claim 22. {Final Office 
Action, page 8, lines 1-5.) As explained above, Jain fails to teach or suggest applying 
two different content analysis algorithms at two different ports and, thus, also fails to 
teach or suggest applying a first content analysis algorithm to a first port of the plurality 
of ports and applying a second content analysis algorithm to a second port of the plurality 
of ports, wherein the second content analysis algorithm is different than the first content 
analysis algorithm, as recited in claim 22. Because Islam, Vairavan and Jain all fail to 
teach or suggest the same element of claim 22, the assignee respectfully submits that the 
obviousness rejection of claim 22 under 35 U.S.C. § 103 was in error and should be 
reversed by the Board. 

I. Claim 23 

Claim 23 depends on claim 22. As such, the foregoing argument demonstrating 

the patentability of claim 22 likewise demonstrates the patentability of this dependent 
claim. Accordingly, the rejection of claim 23, which depends on claim 22, should be 
reversed by the Board. 
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J. Independent Claim 24 

Independent claim 24 recites, among other things, ^''applying a first data content 
analysis algorithm to unanalyzed data content at a first port of the plurality of ports 
and applying a second data content analysis algorithm to unanalyzed data content at a 
second port of the plurality of ports, wherein the second data content analysis 

algorithm is different than the first data content analysis algorithm'" (emphasis added). 
In the final Office action, the Examiner acknowledged that the combination of Islam and 
Vairavan fails to describe applying a first content analysis algorithm to a first port of the 
plurality of ports and applying a second content analysis algorithm to a second port of the 
plurality of ports, wherein the second content analysis algorithm is different than the first 
content analysis algorithm and, thus, fails to describe the foregoing aspect of claim 24. 
{Final Office Action, page 8, lines 1-5.) As explained above, Jain fails to teach or 
suggest applying two different content analysis algorithms at two different ports and, 
thus, also fails to teach or suggest applying a first data content analysis algorithm to 
unanalyzed data content at a first port of the plurality of ports and applying a second data 
content analysis algorithm to unanalyzed data content at a second port of the plurality of 
ports, wherein the second data content analysis algorithm is different than the first data 
content analysis algorithm, as recited in claim 24. Because Islam, Vairavan and Jain all 
fail to teach or suggest the same element of claim 24, the assignee respectfully submits 
that the obviousness rejection of claim 24 under 35 U.S.C. § 103 was in error and should 
be reversed by the Board. 
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Ground II. Claim 9 is Patentable Over the Combination of 
Islam, Vairavan, Jain and Wilson 

Claim 9 

A. Claim 9 is Patentable over the Combination of Islam, Vairavan and Jain 

Claim 9 depends on claim 1. As such, the foregoing argument demonstrating the 
patentability of claim 1 likewise demonstrates the patentability of claim 9 over the 
combination of Islam, Vairavan and Jain. 

B. Wilson Fails to Overcome the Deficiencies of the Islam, Vairavan and Jain 
Combination with Respect to Claim 9 

As explained above, neither Islam, Vairavan nor Jain teach or suggest applying a 

&st content analysis algorithm to a first port of a plurality of ports and applying a second 

content analysis algorithm to a second port of a plurality of ports, wherein the second 

content analysis algorithm is different than the first content analysis algorithm, as recited 

in claim 1 from which claim 9 depends. The Examiner does not rely on Wilson to 

overcome this deficiency of the Islam, Vairavan and Jain combination. Instead, the 

Examiner contends that Wilson, at col. 22, lines 27-32, and col. 29, lines 16-24, describes 

that each of the plurality of ports comprises a dedicated processor and each dedicated 

processor for a respective port independently applies a separate content analysis 

algorithm to unanalyzed content at the port, whereby each of the plurality of ports 

analyzes content with its respective processor, as recited in claim 9. Even if such a 

contention is true (a point not conceded by the assignee), these portions of Wilson, like 

Islam, Vairavan and Jain, fail to teach or suggest applying two different content analysis 
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algorithms at two different switch ports. Thus, because Islam, Vairavan, Jain and Wilson 

all fail to teach or suggest the same element of claim 9, the assignee respectfully submits 

that the obviousness rejection of claim 9 under 35 U.S.C. § 103 was in error and should 

be reversed by the Board. 

Ground III. Claim 15 is Patentable Over the Combination of 
Islam, Webb and Jain 

Claim 15 

A. The Combination of Islam, Webb and Jain is Missing at Least One Element 
of Claim 15 

Claim 15 is repeated here for ease of reference: 

15. A method of providing content analysis policy to a 
plurality of networks, the method comprising: 

establishing a communication link between a switch 
in each of a plurality of subscriber networks and an 
application management appliance of a managed sei-vice 
provider network via an external communications network; 

transmitting one of instructions or update 
information for a content analysis application from the 
application management appliance to the switch in each of 
the plurality of subscriber networks, the content analysis 
application comprising a first content analysis appUcation 
and a second content analysis application, wherein the 
switch in each of the plurality of subscriber networks 
comprises a plurality of ports; and 

applying the first content analysis application to a 
first port of the plurality of ports and applying the second 
content analysis application to a second port of the 
plurality of ports, wherein the second content analysis 
application is different than the first content analysis 
application ; and 

receiving performance metrics of the first and 
second different content analysis applications from each of 
the plurality of subscriber networks, and wherein receiving 
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performance metrics comprises receiving performance 
metrics for each of the plurality of ports in substantially 
real time. 

Claim 15 is nonobvious and, thus, patentable because the combination of Islam, 
Webb and Jain fails to teach or suggest applying a first content analysis application to a 
first port of a plurality of ports and applying a second content analysis application to a 
second port of the plurality of ports, wherein the second content analysis application is 
different than the first content analysis application. 

B. The Combination of Islam and Webb Fails to Teach or Suggest Applying the 
First and Second Content Analysis Applications as Recited in Claim 15 

As noted above, the final Office action rejected claim 15 as being unpatentable 

over the combination of Islam, Webb and Jain under 35 U.S.C. § 103. However, in the 

final Office action, the Examiner acknowledged that the combination of Islam and Webb 

fails to describe a content analysis application comprising a first content analysis 

application and a second content analysis application, wherein the switch in each of the 

plurality of subscriber networks comprises a plurality of ports, and applying the first 

content analysis application to a first port of the plurality of ports and applying the 

second content analysis application to the second port of a plurality of ports, wherein the 

second content analysis application is different than the first content analysis application, 

as recited in claim 15. {Final Office Action, page 12, lines 6-12.) The assignee 

respectfully agrees with this determination. 
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C. Jain Fails to Overcome the Deficiencies of the Islam and Webb Combination 
with Respect to Claim 15 

The Examiner relies on Jain to overcome the acknowledged deficiencies of the 

Islam and Webb combination with respect to claim 15. However, as explained above in 

connection with claim 1, Jain fails to teach or suggest applying two different content 

analysis algorithms at two different ports and, thus, also fails to teach or suggest applying 

a first content analysis application to a first port of a plurality of ports and applying a 

second content analysis application to a second port of the plurality of ports, wherein the 

second content analysis application is different than the first content analysis application, 

as recited in claim 15. Because Islam, Webb and Jain all fail to teach or suggest the same 

element of claim 15, the assignee respectfully submits that the obviousness rejection of 

claim 15 under 35 U.S.C. § 103 was in error and should be reversed by the Board. 

Ground IV. Claims 16-21are Patentable Over the Combination of 
Islam, Vairavan, Van Home and Jain 

Claims 16-21 

A. The Combination of Islam, Vairavan, Van Home and Jain is Missing at Least 
One Element of Claim 16 

Claim 16 is repeated here for ease of reference: 

16. A local area network switch system having content 
analysis capabilities comprising: 
a billing server; 

a plurality of ports in communication with the 
billing server, each of the plurality of ports configured for 
communication with a respective external device, and each 
of the plurality of ports comprising: 

an interface connection adapted for 
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connecting with a communication line of an external 

device; 

a processor in communication with the 
interface connection; 

a memory in communication with the 

processor; 

an application buffer in communication with 
the processor and the memory, wherein the application 
buffer contains logic operative on the processor to analyze 
a content of information passing between the external 
device and the port; and 

a communication bus in communication 
with each of the plurality of ports, the communication bus 
adapted to carry inforaiation between the plurality of ports, 

wherein a first application buffer contains logic 
for applying a first content analysis algorithm to a first 
port of the plurality of ports and a second application 
buffer contains logic for applying a second content 
analysis algorithm to a second port of the plurality of 
ports, wherein the second content analysis algorithm is 
different than the first content analysis algorithm, 

wherein the billing server is operable to track 
charges for content analysis services and bill on a per port 
basis. 

Claim 16 is nonobvious and, thus, patentable because the combination of Islam, 
Vairavan, Van Home and Jain fails to teach or suggest a first application buffer that 
contains logic for applying a first content analysis algorithm to a first port of the plurality 
of ports and a second application buffer that contains logic for applying a second content 
analysis algorithm to a second port of the plurality of ports, wherein the second content 
analysis algorithm is different than the first content analysis algorithm. 
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B. The Combination of Islam ^ Vairavan and Van Home Fails to Teach or 
Suggest Applying the First and Second Content Analysis Algorithms as Recited in 
Claim 16 

As noted above, the final Office action rejected claim 16 as being unpatentable 
over the combination of Islam, Vairavan, Van Home and Jain under 35 U.S.C. § 103. 
However, in the final Office action, the Examiner acknowledged that the combination of 
Islam, Vairavan and Van Home fails to describe a first application buffer that contains 
logic for applying a first content analysis algorithm to a first port of the plurality of ports 
and a second application buffer that contains logic for applying a second content analysis 
algorithm to a second port of the plurality of ports, wherein the second content analysis 
algorithm is different than the first content analysis algorithm, as recited in claim 16. 
{Final Office Action, page 15, lines 3-7.) The assignee respectfully agrees with this 
determination. 

C. Jain Fails to Overcome the Deficiencies of the Islam, Vairavan and Van 
Home Combination with Respect to Claim 16 

The Examiner relies on Jain to overcome the acknowledged deficiencies of the 

Islam, Vairavan and Van Home combination with respect to claim 16. However, as 

explained above in connection with claim 1, Jain fails to teach or suggest applying two 

different content analysis algorithms at two different ports and, thus, also fails to teach or 

suggest a first application buffer that contains logic for applying a first content analysis 

algorithm to a first port of the plurality of ports and a second application buffer that 

contains logic for applying a second content analysis algorithm to a second port of the 
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plurality of ports, wherein the second content analysis algorithm is different than the first 
content analysis algorithm, as recited in claim 16. Because Islam, Vairavan, Van Home 
and Jain all fail to teach or suggest the same element of claim 16, the assignee 
respectfully submits that the obviousness rejection of claim 16 under 35 U.S.C. § 103 
was in error and should be reversed by the Board. 

D. Claims 17-21 

Claims 17-21 depend on claim 16. As such, the foregoing argument 
demonstrating the patentability of claim 16 likewise demonstrates the patentability of 
these dependent claims. Accordingly, the rejections of claims 17-21, which depend on 
claim 16, should be reversed by the Board. 

E. Claim 18 

Claim 18 depends on claim 16. Therefore, for at least the reasons the rejection of 
claim 16 must be reversed, the rejection of claim 18 must likewise be reversed. 

Furthermore, claim 18 specifies that at least one of the application buffers as 
recited in claim 16 is to include anti-virus filtering logic. Claim 16 specifies that each of 
the plurality of ports comprises an application buffer in communication with the 
processor and the memory, wherein the application buffer contains logic operative on the 
processor to analyze a content of information passing between the external device and the 
port. Thus, properly construed, claim 18 requires that the anti-virus filtering logic, which 
is included in an application buffer, is to be operative on a processor to analyze a content 
of information passing between an external device and a port. 
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The Examiner contends that the recitation of claim 18 may be found at paragraph 
[0105] of Vairavan. However, as explained above in connection with claim 6, although 
paragraph [0105] indicates that the anti-virus module in Vairavani's inter/intra- 
networking device centrally controls an anti-virus package, the anti-virus package is 
actually pushed to the various devices coupled to the inter/intra-networking device. 
Thus, like the prior art described in paragraph [0003] of the instant specification, 
Vairavani describes performing anti-virus detection at each device in the network, but 
does not teach or suggest anti-virus filtering logic that is to be operative on a processor to 
analyze a content of information passing between an external device and a port , as recited 
in claim 18. Accordingly, the rejection of claim 18 is in error and should be reversed by 
the Board. 

Conclusion 

In view of the foregoing remarks, it is respectfully submitted that the rejections of 
claims 1-7 and 9-24 made in the final Office action should be overturned. 

Respectfully submitted, 

By: AVilliam E. Jacklin/ 
William E. Jacklin 
Registration No. 64,894 

November 5, 2010 



30 



U.S. Serial No. 10/682,366 
Brief on Appeal 

VIII. Claims Appendix 

1. (Rejected) A method for analyzing data content received at a local area network 
from an external communications network, wherein the method comprises: 

receiving unanalyzed content at a local area network; 

passing the unanalyzed content to a switch in the local area network; 

analyzing the unanalyzed content at the switch and generating analyzed data; and 

routing the analyzed data to a device in the local area network in communication 
with the switch, wherein the switch comprises a plurality of ports, and wherein analyzing 
the unanalyzed content at the switch comprises the switch scanning the plurality of ports 
and applying a content analysis algorithm to each of the plurality of ports, 

wherein applying the content analysis algorithm comprises applying a first 
content analysis algorithm to a first port of the plurality of ports and applying a second 
content analysis algorithm to a second port of the plurality of ports, wherein the second 
content analysis algorithm is different than the first content analysis algorithm. 

2. (Rejected) The method of claim 1, wherein the step of analyzing the 
unanalyzed content comprises applying a content filtering algorithm to the unanalyzed 
content upon ingress at one of the plurality of ports. 

3. (Rejected) The method of claim 1, wherein the step of analyzing the 
unanalyzed content comprises applying a content filtering algorithm to the unanalyzed 
content upon egress at one of the plurality of ports. 
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4. (Rejected) The method of claim 1 wherein the unanalyzed content is formatted 
in data packets. 

5. (Rejected) The method of claim 4, wherein analyzing the unanalyzed content at 
the switch comprises the switch applying the content analysis algorithm to each data 
packet of unanalyzed content. 

6. (Rejected) The method of claim 5, wherein the switch applying the content 
analysis algorithm comprises the switch executing an antivirus algorithm. 

7. (Rejected) The method of claim 5, wherein the switch applying the content 
analysis algorithm comprises the switch executing an intrusion detection algorithm. 

8. (Canceled). 

9. (Rejected) The method of claim 1, wherein each of the plurality of ports 
comprises a dedicated processor and each dedicated processor for a respective port 
independently applies a separate content analysis algorithm to unanalyzed content at the 
port, whereby each of the plurality of ports analyzes content with its respective processor. 

10. (Rejected) The method of claim 1, further comprising receiving a content 
analysis software update at the switch from a managed service provider network via the 
external communications network. 



32 



U.S. Serial No. 10/682,366 
Brief on Appeal 

11. (Rejected) The method of claim 10, further comprising applying the content 

analysis software update to each of the plurality of ports at the switch configured to 
implement content analysis software contained in the content analysis software update. 

12. (Rejected) A method of managing content analysis for a local area network 
from a managed service provider network, wherein the local area network comprises a 
switch in communication with an external communications network and at least one 
device in conmiunication with the switch, wherein the method comprises: 

establishing a communication link between the switch of the local area network 
and the managed service provider network via the external communications network; 

transmitting port configuration instructions from the managed service provider 
network to the switch of the local area network, the port configuration instructions 
comprising instructions to configure a plurality of ports on a port-to-port basis at the 
switch to implement at least two content analysis functions and to cause the switch to 
scan and apply a first content analysis function to a first selected port of the plurality of 
ports and scan and apply a second content analysis - function to a second selected port of 
the plurality of ports, wherein the second content analysis function is different than the 
first content analysis function. 
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13. (Rejected) The method of claim 12, further comprising: 

receiving a content analysis software update at the managed service provider 
network; 

transmitting the content analysis software update to the switch and updating 
content analysis software at the switch with the content analysis software update. 

14. (Rejected) The method of claim 12, further comprising monitoring content 
analysis activity at the switch from the managed service provider network. 
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15. (Rejected) A method of providing content analysis policy to a plurality of 
networks, the method comprising: 

establishing a communication link between a switch in each of a plurality of 
subscriber networks and an application management appliance of a managed service 
provider network via an external communications network; 

transmitting one of instructions or update information for a content analysis 
application from the application management appliance to the switch in each of the 
plurality of subscriber networks, the content analysis application comprising a first 
content analysis application and a second content analysis application, wherein the switch 
in each of the plurality of subscriber networks comprises a plurality of ports; and 

applying the first content analysis application to a first port of the plurality of 
ports and appljdng the second content analysis application to a second port of the 
plurality of ports, wherein the second content analysis application is different than the 
first content analysis application; and 

receiving performance metrics of the first and second different content analysis 
applications from each of the plurality of subscriber networks, and wherein receiving 
performance metrics comprises receiving performance metrics for each of the plurality of 
ports in substantially real time. 
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16. (Rejected) A local area network switch system having content analysis 
capabilities comprising: 
a billing server; 

a plurality of ports in communication with the billing server, each of the plurality 
of ports configured for conmiunication with a respective extemal device, and each of the 
plurality of ports comprising: 

an interface connection adapted for connecting with a communication line 
of an extemal device; 

a processor in communication with the interface connection; 

a memory in communication with the processor; 

an application buffer in communication with the processor and the 
memory, wherein the application buffer contains logic operative on the processor to 
analyze a content of information passing between the extemal device and the port; and 

a communication bus in communication with each of the plurality of ports, 
the communication bus adapted to carry infon-nation between the plurality of ports, 
wherein a first application buffer contains logic for applying a first content 
analysis algorithm to a first port of the plurality of ports and a second application buffer 
contains logic for applying a second content analysis algorithm to a second port of the 
plurality of ports, wherein the second content analysis algorithm is different than the first 
content analysis algorithm, 
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wherein the billing server is operable to track charges for content analysis services 
and bill on a per port basis. 

17. (Rejected) The apparatus of claim 16 further comprising an application buffer 

administrative interface in communication with the communication bus, wherein the 
application buffer administrative interface comprises content analysis resources 
accessible by the application buffer for each of the plurality of ports. 

18. (Rejected) The apparatus of claim 16, wherein at least one of the application 
buffers comprises anti-virus filtering logic. 

19. (Rejected) The apparatus of claim 16, wherein at least one of the application 
buffers comprises network security logic. 

20. (Rejected) The apparatus of claim 16, wherein at least one of the application 
buffers comprises content filtering logic. 

21. (Rejected) The apparatus of claim 17, wherein the application buffer 

administrative interface comprises anti-virus definitions adapted for use by anti-virus 
logic stored on an application buffer at each of the plurality of ports. 
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22. (Rejected) A method for analyzing data content received at a local area 
network from an external communications network, wherein the method comprises: 

receiving at a local area network unanalyzed data content in a data field of a data 
packet formatted according to a communications protocol; 

passing the unanalyzed data content to a switch in the local area network; 
analyzing the unanalyzed data content at the switch and generating analyzed data; 

and 

routing the analyzed data to a device in the local area network in communication 
with the switch, wherein the switch comprises a plurality of ports, and wherein analyzing 
the unanalyzed content at the switch comprises the switch scanning the plurality of ports 
and applying a content analysis algorithm to each of the plurality of ports, 

wherein applying the content analysis algorithm comprises applying a first 
content analysis algorithm to a first port of the plurality of ports and applying a second 
content analysis algorithm to a second port of the plurality of ports, wherein the second 
content analysis algorithm is different than the first content analysis algorithm. 

23. (Rejected) The method of claim 22, wherein the first content analysis 
algorithm comprises a first data content analysis algorithm, and wherein the second 
content analysis algorithm comprises a second data content analysis algorithm. 
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24. (Rejected) A method for analyzing data content received at a local area 
network from an external communications network, wherein the method comprises: 

receiving at a local area network unanalyzed data content in a data field of a data 
packet formatted according to a communications protocol; 

passing the unanalyzed data content to a switch in the local area network; 

analyzing the unanalyzed data content at the switch and generating analyzed data; 

and 

routing the analyzed data to a device in the local area network in communication 
with the switch, wherein the switch comprises a plurality of ports, and wherein analyzing 
the unanalyzed data content at the switch comprises the switch scanning the plurality of 
ports and applying a data content analysis algorithm to each of the plurality of ports, 

wherein applying the data content analysis algorithm comprises applying a first 
data content analysis algorithm to unanalyzed data content at a first port of the plurality 
of ports and applying a second data content analysis algorithm to unanalyzed data content 
at a second port of the plurality of ports, wherein the second data content analysis 
algorithm is different than the first data content analysis algorithm. 
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IX. Evidence Appendix 



No evidence under 37 C.F.R. § 1.130, 1.131, or 1.132 is being relied upon. The 
evidence relied upon is reflected in the following table. 



Reference 


Entered in Record 


Islam, U.S. Publication No. 
2003/0035430 


See the final Office action dated April 1, 
2009, page 2. 


Vairavan, U.S. Publication No. 
2002/0083344 


See the final Office action dated April 1, 
2009, page 2. 


Jain, U.S. Patent No. 6,324,575 


See the final Office action dated April 1, 
2009, page 2. 


Wilson, U.S. Patent No. 4,292,465 


See the final Office action dated April 1, 
2009, page 10. 


Webb, U.S. Publication No. 
2002/0120741 


See the final Office action dated April 1, 
2009, page 11. 


Van Home, U.S. Patent No. 5,987,430 


See the final Office action dated April 1, 
2009, page 13. 



Copies of the above-noted evidence are attached hereto. 
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X. Related Proceedings Appendix 

None. 



